Splunk Search

Help with lookup to get table?

simo
Path Finder

Hi,

I have a lookup as follow

ip id name
111.111.111.111 111 simone
* 222 marco

in the index I have 

ip id 
111.111.111.111 111
222.222.222.222 222
333.333.333.333 222

 

the result I'm looking for is the following

ip id  name
111.111.111.111 111 simone
222.222.222.222 222 marco
333.333.333.333 222 marco

 

can help me?

thank you

Simone

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and why it didn't work for you.  Also, it's not clear what the key is in the lookup file.  Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally.  The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition.  Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save.  Then the command becomes

| lookup mylookup ip id OUTPUT name

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and why it didn't work for you.  Also, it's not clear what the key is in the lookup file.  Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally.  The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition.  Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save.  Then the command becomes

| lookup mylookup ip id OUTPUT name

 

---
If this reply helps you, Karma would be appreciated.

simo
Path Finder

@richgalloway thanks thats what i was looking for! 🙂

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...